fix(codeql): wake required jobs with the exchanged target app token

.github/workflows/codeql-scan-dispatch.yml

@@ -523,20 +523,60 @@ jobs:
           && needs.validate-dispatch.outputs.required_run_id != ''
           && needs.validate-dispatch.outputs.required_jobs != ''
         env:
-          GH_TOKEN: ${{ needs.validate-dispatch.outputs.target_repository == github.repository && github.token || secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN }}
+          TARGET_APP_WAKE_TOKEN: ${{ steps.target_app_token.outputs.token || '' }}
+          PR_REVIEW_MERGE_WAKE_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || '' }}
+          OPENCODE_APPROVE_WAKE_TOKEN: ${{ secrets.OPENCODE_APPROVE_TOKEN || '' }}
+          GITHUB_WAKE_TOKEN: ${{ needs.validate-dispatch.outputs.target_repository == github.repository && github.token || '' }}
           TARGET_REPOSITORY: ${{ needs.validate-dispatch.outputs.target_repository }}
           PR_NUMBER: ${{ needs.validate-dispatch.outputs.pr_number }}
           HEAD_SHA: ${{ needs.validate-dispatch.outputs.head_sha }}
           REQUIRED_RUN_ID: ${{ needs.validate-dispatch.outputs.required_run_id }}
           REQUIRED_JOBS: ${{ needs.validate-dispatch.outputs.required_jobs }}
           REQUIRED_LANGUAGE: ${{ matrix.language }}
-          WAKE_TOKEN_SOURCE: ${{ needs.validate-dispatch.outputs.target_repository == github.repository && 'github-token' || secrets.PR_REVIEW_MERGE_TOKEN != '' && 'PR_REVIEW_MERGE_TOKEN' || secrets.OPENCODE_APPROVE_TOKEN != '' && 'OPENCODE_APPROVE_TOKEN' || 'unavailable' }}
+          GATE_OUTCOME: ${{ steps.gate.outcome }}
         run: |
           set -euo pipefail
-          if [ -z "${GH_TOKEN:-}" ] || [ "$WAKE_TOKEN_SOURCE" = "unavailable" ]; then
+          read_token="${TARGET_APP_WAKE_TOKEN:-}"
+          if [ -z "$read_token" ]; then
+            read_token="${PR_REVIEW_MERGE_WAKE_TOKEN:-}"
+          fi
+          if [ -z "$read_token" ]; then
+            read_token="${OPENCODE_APPROVE_WAKE_TOKEN:-}"
+          fi
+          if [ -z "$read_token" ]; then
+            read_token="${GITHUB_WAKE_TOKEN:-}"
+          fi
+          if [ -z "$read_token" ]; then
+            if [ "${GATE_OUTCOME:-}" = "success" ]; then
+              echo "::notice::CodeQL wake credential is unavailable after a successful scan. Compatibility will read the completed dispatch scan job."
+              exit 0
+            fi
             echo "::error::Actions-capable CodeQL wake credential is unavailable."
             exit 1
           fi
+
+          run_api() {
+            token_label="$1"
+            token="$2"
+            shift 2
+            if [ -z "$token" ]; then
+              return 1
+            fi
+            if GH_TOKEN="$token" gh api "$@"; then
+              echo "::notice::CodeQL wake API used ${token_label}." >&2
+              return 0
+            fi
+            echo "::notice::CodeQL wake API using ${token_label} did not succeed." >&2
+            return 1
+          }
+
+          github_api() {
+            run_api "target-app-token" "$TARGET_APP_WAKE_TOKEN" "$@" ||
+              run_api "pr-review-merge-token" "$PR_REVIEW_MERGE_WAKE_TOKEN" "$@" ||
+              run_api "opencode-approve-token" "$OPENCODE_APPROVE_WAKE_TOKEN" "$@" ||
+              run_api "github-token" "$GITHUB_WAKE_TOKEN" "$@"
+          }
+
           REQUIRED_JOB_ID="$(printf '%s' "$REQUIRED_JOBS" | jq -r --arg lang "$REQUIRED_LANGUAGE" '
             [.[] | select(.language == $lang) | .job_id | tostring]
             | if length == 1 and (.[0] | test("^[1-9][0-9]*$")) then .[0] else empty end
@@ -548,15 +588,21 @@ jobs:
             exit 1
           fi
 
-          pull="$(gh api "repos/${TARGET_REPOSITORY}/pulls/${PR_NUMBER}")"
+          if ! pull="$(github_api "repos/${TARGET_REPOSITORY}/pulls/${PR_NUMBER}")"; then
+            echo "::error::CodeQL wake could not read the current pull request."
+            exit 1
+          fi
           live_state="$(printf '%s' "$pull" | jq -r '.state // empty')"
           live_head="$(printf '%s' "$pull" | jq -r '.head.sha // empty')"
           if [ "$live_state" != "open" ] || [ "$live_head" != "$HEAD_SHA" ]; then
             echo "::error::CodeQL wake rejected a closed PR or stale head."
             exit 1
           fi
 
-          run="$(gh api "repos/${TARGET_REPOSITORY}/actions/runs/${REQUIRED_RUN_ID}")"
+          if ! run="$(github_api "repos/${TARGET_REPOSITORY}/actions/runs/${REQUIRED_RUN_ID}")"; then
+            echo "::error::CodeQL wake could not read the required run."
+            exit 1
+          fi
           run_identity="$(printf '%s' "$run" | jq -r --arg head "$HEAD_SHA" --argjson run_id "$REQUIRED_RUN_ID" '
             select(.id == $run_id)
             | select(.event == "pull_request")
@@ -565,7 +611,10 @@ jobs:
             | .id // empty
           ')"
           expected_name="CodeQL compatibility analysis (${REQUIRED_LANGUAGE})"
-          job="$(gh api "repos/${TARGET_REPOSITORY}/actions/jobs/${REQUIRED_JOB_ID}")"
+          if ! job="$(github_api "repos/${TARGET_REPOSITORY}/actions/jobs/${REQUIRED_JOB_ID}")"; then
+            echo "::error::CodeQL wake could not read the required job."
+            exit 1
+          fi
           job_identity="$(printf '%s' "$job" | jq -r --arg head "$HEAD_SHA" --arg name "$expected_name" --argjson run_id "$REQUIRED_RUN_ID" --argjson job_id "$REQUIRED_JOB_ID" '
             select(.id == $job_id)
             | select(.run_id == $run_id)
@@ -580,5 +629,36 @@ jobs:
             exit 1
           fi
 
-          gh api -X POST "repos/${TARGET_REPOSITORY}/actions/jobs/${REQUIRED_JOB_ID}/rerun" >/dev/null
-          echo "Re-ran exact failed CodeQL job ${REQUIRED_JOB_ID} for ${REQUIRED_LANGUAGE} on ${HEAD_SHA}."
+          post_wake() {
+            token_label="$1"
+            token="$2"
+            if [ -z "$token" ]; then
+              return 1
+            fi
+            if GH_TOKEN="$token" gh api -X POST "repos/${TARGET_REPOSITORY}/actions/jobs/${REQUIRED_JOB_ID}/rerun" >/dev/null; then
+              echo "Re-ran exact failed CodeQL job ${REQUIRED_JOB_ID} for ${REQUIRED_LANGUAGE} on ${HEAD_SHA} using ${token_label}."
+              return 0
+            fi
+            echo "::notice::CodeQL wake POST using ${token_label} did not succeed."
+            return 1
+          }
+
+          if post_wake "target-app-token" "$TARGET_APP_WAKE_TOKEN"; then
+            exit 0
+          fi
+          if post_wake "pr-review-merge-token" "$PR_REVIEW_MERGE_WAKE_TOKEN"; then
+            exit 0
+          fi
+          if post_wake "opencode-approve-token" "$OPENCODE_APPROVE_WAKE_TOKEN"; then
+            exit 0
+          fi
+          if post_wake "github-token" "$GITHUB_WAKE_TOKEN"; then
+            exit 0
+          fi
+
+          if [ "${GATE_OUTCOME:-}" = "success" ]; then
+            echo "::notice::CodeQL wake POST did not succeed after a successful scan. Compatibility will read the completed dispatch scan job."
+            exit 0
+          fi
+          echo "::error::CodeQL wake POST did not succeed."
+          exit 1

CHANGELOG.md

@@ -1,3 +1,7 @@
+### CodeQL wake uses the same credential chain as status publication
+
+- Wake no longer binds a single `GH_TOKEN` to the first nonempty of the target App token, `PR_REVIEW_MERGE_TOKEN`, `OPENCODE_APPROVE_TOKEN`, or `github.token`. A nonempty App token that cannot rerun jobs (no Actions write, 403, rate-limit) no longer shadows Actions-capable fallbacks. The step now POSTs `/jobs/{id}/rerun` with each nonempty token in the same order as Publish CodeQL dispatch status (`target-app-token`, `pr-review-merge-token`, `opencode-approve-token`, `github-token`). After a successful scan, exhausted wake POSTs still leave the scan job successful so compatibility can read that job. Refs #2040, #2028, naruon#1592.
+
 ### Failed-check finding names the Strix sandbox instead of the gateway
 
 - `opencode-review-dispatch.yml`'s `emit_strix_provider_failure_finding` rendered one fixed finding for every `STRIX_PROVIDER_UNAVAILABLE` line, whose Root cause read "The contextual-orchestrator gateway or its discovered provider pool was unavailable for this run". `#1953` had just given the Strix sandbox bootstrap failure its own second verdict token (`STRIX_SANDBOX_UNAVAILABLE`) precisely because that attribution is wrong for it -- the sandbox container never reaches its Caido proxy, so the run dies before the gateway serves anything -- and this consumer re-applied the wrong attribution one step downstream, into the review findings and the failure census. The emitter now branches on the second token: a sandbox verdict gets a finding that names Strix's sandbox, says the verdict does not name the gateway, and tells the reader not to change gateway or provider configuration on its strength. A `STRIX_PROVIDER_UNAVAILABLE` line without the token keeps its existing text verbatim, so the gateway class has no regression surface. No test covered this finding text at all before (`gateway or its discovered provider pool` matched nothing under `tests/`); `tests/test_opencode_dispatch_strix_sandbox_finding.py` now runs the production emitter from the published run block and pins both directions plus the no-signal case. Refs #1953, #1935.

docs/doctoring/codeql-pr-required-workflow-always-fails.md

@@ -96,3 +96,14 @@ carefully-scoped rewrite (dynamic per-language check names, target-repo
 checkout security boundary) deliberately not attempted in the same tick as
 the emergency ruleset fix above — tracked as a follow-up, not silently
 dropped.
+
+## Wake credential chain (2026-09-08)
+
+The native handler's Wake step must try the same credential order as
+Publish CodeQL dispatch status. naruon#1592 run 34185353127 published after
+#2028's loop, then Wake selected a nonempty target App token that cannot
+POST `/jobs/{id}/rerun` (no Actions write). One 403 plus `GATE_OUTCOME=success`
+exited 0 without trying `PR_REVIEW_MERGE_TOKEN` or `OPENCODE_APPROVE_TOKEN`,
+and compatibility treated the scan job as failed. Wake now POSTs each
+nonempty token in publish order and, after a successful scan, still exits 0
+when every POST fails. Identity GETs stay fail-closed. See #2040.